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FLIGHT MANAGEMENT SYSTEM PROVIDING FOR 
AUTOMATIC CONTROL DISPLAY UNIT BACKUP 
UTILIZING STRUCTURED DATA ROUTING 

Cross-References to Related Applications 

5 This application is based on provisional application No. 60/01 7,784, filed May 

14, 1996 and is entitled to all rights resulting therefrom. 



Background of the Invention 

The present invention relates to the aircraft flight management art and, in 
10 particular, to an improved flight management system comprising redundant control 

display units (CDU's), redundant databases and a flight management computer (FMC), 
which automatically responds to detected failures in CDU's or databuses to maintain 
an operating FMC-CDU interface. 



15 In modem commercial aircraft, a flight crew makes flight plan entries and 

modifications through a Flight Management System comprising one or more flight 
management computers (FMC's) and, typically, left and right control display units 
(CDU's). The FMC's and CDU's are linked by redundant databuses. These CDU's 
are positioned to be accessed by the pilots for purposes of flight plan data entries into 

20 the CDU's and then to the FMC's for implementation of a desired flight plan. 



In some aircraft, a third CDU unh has been provided in the flight deck. 
However, such CDU's are provided to perform functions other than FMC interface. 
In the event that one of the primary left or right CDU's has failed, this leaves only one 
25 CDU remaining for the flight crew to perform FMC operations. Only one operating 
CDU results in reduced crew capability for dealing with flight management functions 
even though an additional CDU might be physically on board. Thus, loss of a CDU 
creates increasing work load for the pilot which has the remaining functional CDU. A 
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second fault in a CDU or associated databus could result in the total loss of CDU 
control. 

In addition, failure of one or more of the redundant databuses can similarly 
5 result in reduced system capability. 

In certain previous avionics designs, manually operated switches in the cockpit 
allow the flight crew to reconfigure the data path from the FMC to the CDU's. Given 
that the switching was simple, there were failure combinations that the crew could not 
10 correct, resulting in the loss of one or more CDU's to control the FMC. 

In addition, it has not been practical to swap CDU's in flight. Maintenance has 
to be deferred until completion of the current flight leg. 

15 Summary of the Invention 

It is an object of this invention, therefore, to provide an improved aircraft flight 
management system which, upon detection of a failed control display unit or databus, 
automatically reroutes the data to maintain an operating CDU. 

20 These and other objects of the invention will become apparent upon review of 

the specification and the claims set forth below. 

Briefly, according to the invention, an improvement is provided in an aircraft 
flight management system which includes at least one flight management computer 

25 (FMC), at least two control display units (CDU's) and at least two databuses 
permitting interfaces to the said at least one FMC from said CDU's. The 
improvement comprises logic control which is associated with the FMC. The logic 
control includes means for detecting the failure of one of said CDU's and/or 
databuses and, in response thereto, utilizing structured data routing to reroute signals 

30 over a non-failed databus to connect a non-failed CDU to the FMC. 
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In an aircraft flight management system which includes at least one flight 
management computer (FMC) left and right control display units (CDU's) permitting 
interfaces to the FMC from left and right pilot positions, respectively, and a third, 
5 backup CDU, an improved method for improving the backup CDU to automatically 
function in place of a failed left or right CDU comprises the steps of: 

a) at least two databuses linking the at least one FMC to the left, right and 
backup CDU's; and 

10 b) providing logic control, associated with at least one FMC, the logic 

control performing the steps of: 

i) detecting failure of one of the left and right CDU's and/or 
databuses and, responsive thereto, 

ii) utilizing structured data routing to automatically reroute signals 
15 over a non-failed databus to the backup CDU such that the 

backup CDU is fully functional in place of the failed left or right 
CDU. 

Brief Description of the Drawing(s) 

20 

Figure 1 is a diagram illustrating the general appearance and relative 
interconnection of the flight management system including the control display unit 
(CDU), databuses, navigation display (MAP) and logic module; 

25 Figure 2 depicts an aircraft main instrument panel and its interconnecting 

relationship to the flight management computers, autopilot flight director system, flight 
control computers, interconnecting digital databuses and the three CDU's; 
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Figure 3 is a logic flow diagram depicting the logical steps performed by the 
improved flight management system as shown in Figure 2 in implementing CDU 
backup; 

5 Figure 4 is a logic flow diagram depicting the logical steps performed by the 

improved flight management system in utilizing structured data routing to implement 
CDU and databus backup; 

Figures 5A, 5B and 5C are tables depicting the CDU/Bus selection matrix in 
10 accordance with the preferred embodiment of the invention; and 

Figure 6 is a table illustrating example CDU/Bus reconfigurations in 
accordance with the preferred embodiment of the invention. 

IS Description of a Preferred Embodiment 

Figure 1 illustrates in both graphic and block diagram form the primary 
components of a modern commercial flight management system, indicated generally at 
30. Shown at 32 is a conventional aircraft navigational Flight Management System - 

20 Control Display Unit (FMS-CDU). The FMS-CDU 32 includes an upper face portion 
34 and a lower fece portion 36. In its upper face portion 34, the FMS-CDU 32 
includes an electronic display 40 which is capable of displaying lines of text entered by 
the flight crew. These lines of text depict, typically, waypoints along the path of a 
desired navigational route. On both sides of and adjacent to the electronic display 40 

25 are line select keys, indicated generally at 42 and 44. Upon the user activating one of 
the line select keys 42, 44, the adjacent line of text on the electronic display is activated 
to thereby allow entry, selection or deletion of text. 
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At the lower portion of the electronic display is scratch pad line 46 which 
displays system generated messages, entries via the keyboard (described below) and 
data being moved from one line to another. 

5 In the lower face half 36 of the FMS-CDU 32 is a keyboard, indicated 

generally at 50. The keyboard 50 includes an array of keys as well as control inputs by 
which the flight crew can manually enter waypoints, which then appear on the 
electronic display 40 as text line items. Also included are various control keys which 
allow the flight crew to add, modify, and delete various entries. 

10 

For example, a provided Execute key 52 is a momentary action push button 
which becomes illuminated to indicate a modification to the active route. Upon the 
flight crew pushing the Execute key 52, a desired modification is activated and 
illumination of the key is extinguished. 

15 

A provided Delete key 54 is a momentary action switch which, when activated 
by the flight crew, enters DELETE in the scratch pad portion 46 of the electronic 
display 40. When the scratch pad is blank, a selection of a subsequent line by line 
select keys 42, 44 deletes data on the corresponding adjacent line if such information is 
20 deletable. 

Thus, by way of typed entries via the keypad 50, the flight crew enters 
waypoints along the desired navigational route. These waypoints are displayed as lines 
of text on the electronic display 40. 

25 

Also provided as a display to the flight crew of the desired navigational route is 
a navigational display (MAP) 60. The navigation display 60 depicts the current 
position of the aircraft, herein indicated by the triangle 62, at selected waypoints along 
the desired route such as the indicated waypoint "VAMPS" at 64, the next selected 
30 waypoint "RUMOR" at 66 and the final waypoint "ELN" at 67. 
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In addition to the route information also depicted on the navigation display 60 
is the current magnetic track heading 68 and an arcuate line 70 which depicts a portion 
of a compass rose. 

5 

Also depicted in the upper left hand corner of the display 60 is information 
indicating the current ground speed, true air speed, wind speed and wind heading 
information, collectively shown at 72. 

10 The navigation display 60 and FMS-CDU 32 interconnect through a logic 

module indicated generally at 80. The logic module 80 includes the flight management 
computer (FMC) 82. In addition, the logic includes the graphics generator (display 
module) 84. Inputs from the logic module 80 to and from the FMS-CDU 32 are 
carried along a multi-way bus 86, whereas display information from the graphics 

15 generator 84 is carried to the navigation display 60 via a one-way bus 88. 

The flight management computer 82 provides lateral (LNAV) and vertical 
(VNAV) guidance signals to the autopilot flight director system (AFDS) 83, which 
validates and acknowledges the guidance signals. The AFDS 83 then provides 
20 guidance signals to the Primary Flight Computer (PFC) 84 which activates the 

aircraft's control surfaces 85 in the normal manner such that the aircraft is directed to 
automatically fly the route as selected by the flight management computer 62. 

Figure 2 illustrates a typical navigation arrangement as found in a modern 
25 commercial aircraft. Shown are left and right flight management computers (FMCs) 
102, 104, respectively. The left and right FMC's 102, 104 communicate with 
associated left and right control display units (CDlTs) 1 12, 1 14, respectively. The left 
and right CDlTs 1 12, 1 14 are arranged for easy access by the pilots. As is often 
provided in modern commercial aircraft, a third, backup, or center channel CDU 120 is 
30 also provided. The third CDU 120 is used in some aircraft to interface to other aircraft 
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systems such as satellite communications, S ATCOM, and/or the public address/cabin 
interphone system (PACT). 

The CDU's 112, 1 14 and 120 and FMC's 102, 104 communicate over a triple 
5 redundant data link or bus 122A, B, C. The two FMC's 102, 104 also communicate 
over an FMC's intercabinet bus 123, the function of which maintains synchronization 
of data states between the two FMC's 102, 104. 

In normal operation, one of the two FMC's 102, 104 assumes primary control, 
10 here identified as left FMC 102. Thus, outputs from FMC 102 are provided both to 
the main instrument panel 140 and to an autopilot flight director system ISO. The main 
instrument panel 140 includes left and right primary flight displays 142, 144, which are 
driven by left and right outputs from the autopilot flight director system 1 50. Left and 
right navigation displays 146, 148, respectively are driven by corresponding outputs 
15 from the primary FMC 102. A central engine and crew altering display 149 is also 
provided in the main instrument panel 140. 

In the manner described with respect to Figure 1, flight crew entries into the 
left and right CDU's 1 12, 1 14 of desired flight plans are then transferred to the FMC's 
20 102, 104, with corresponding graphical depiction of the flight plans set forth on the left 
and right navigation displays 142, 144. 

Output navigation guidance signals for both vertical navigation VNAV and 
lateral navigation LNAV are provided from the primary FMC 102 to the autopilot 
25 flight director system 150. 

The autopilot flight director system 150 then produces corresponding output 
signals which pass to the primary flight computers 160. The primary flight computers 
160 , in turn, produce appropriate control signals which are applied to the aircraft's 
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flight control surfaces 170 to cause the aircraft to fly in accordance with the flight crew 
entered flight plan in the CDU's 1 12, 1 14. 

Prior to the present invention, if either of the left or right CDU's 1 12, 1 14 
5 foiled, there has been no means to cause backup CDU 120 to assume the function of 
the failed CDU. Swapping of the failed unit with a backup unit is normally a 
maintenance function which is not performed during flight operations. Thus, if either 
the left or right CDU 112, 114 fails, the pilot with the remaining operating CDU 
assumes an additional, burdensome workload. The present invention overcomes this 
10 limitation of the prior art systems by providing the capability for an FMC 102, 1 04 to 
automatically detect a failed CDU and operationally implement the backup CDU 120 
to act in place of the failed unit. 

In addition, the present invention is capable of detecting failure of one or more 
15 of the databuses 122A, B, C to reconfigure the connections between the FMC's 102, 
104 to the CDU's 1 12, 1 14 and 120. Basically, if only one FMC 102, 104, one CDU 
1 12, 1 14 and 120, and one of the three databuses 122 A, B, C is operative, the present 
system will reconfigure to interconnect the operating units and provide CDU control of 
the FMC. 

20 

Figure 3 is a logic flow diagram illustrating the logic steps performed by the 
primary FMC to automatically implement backup of a failed CDU. Here, the logic 
begins at block 200. Then, at decision block 202, the system determines whether or 
not the left CDU (102 of Figure 2) is healthy (i.e. operating property, and properly 
25 communicating with the FMC). This determination includes review of a CDU 
generated status bit which indicates that the CDU is operating properly. Such 
communication takes place over digital database 122 A, B, C as shown in Figure 2. 
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15 



If, out of decision block 202, the FMC logic determines that the left CDU is 
operating properly, block 204 is entered. In block 204, the FMC logic directs that the 
left page of the CDU display be sent to the properly operating, left CDU. 

Then, at decision block 206, the FMC logic determines whether or not the right 
CDU is functioning properly. This, as before, requires the FMC to monitor the signals 
being applied to the digital databus by the right CDU to determine whether or not such 
signals indicate proper right CDU operation, including review of self check status bits 
which are generated by the right CDU. 

If, out of decision block 206, it is determined that the right CDU is operating 
properly, the system then enters block 210. In block 210, the FMC logic causes the 
right page display to be sent to the right CDU. The system then reverts to 212 causing 
the logic to begin again at the begin stage 200. 



If, at decision block 202, the FMC logic determines that the left CDU is not 
operating properly, decision block 220 is entered. At decision block 220, the FMC 
logic determines whether the center, or backup CDU (120 in Figure 2) is operating 
properly. If the backup CDU is operating properly, the logic enters block 222. At 
20 block 222, the FMC logic now causes the left page display to be sent to the center, or 
backup CDU, As such, the backup CDU can now function in place of the failed CDU. 

However, if at decision block 220 it is determined that the center, or backup 
CDU is not operating properly, the system raters a decision block 224. Decision block 
25 224 is also entered out of block 222. 

At decision block 224, the FMC logic determines whether or not the right 
CDU is functioning properly. If the right CDU is functioning properly, the logic enters 
block 210 and the right page display is then sent to the right CDU, with the system 
30 returning to the begin function 200 through intermediate step 212. 
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If, however, out of decision block 224 it is determined that the right CDU is 
not operating properly, the system returns to the begin position 200 through 
intermediate position 212. 

5 

Returning to decision block 206, if the FMC logic determines that the right 
CDU is not operating properly, a decision block 230 is entered. In decision block 230, 
the FMC logic determines whether or not the center, or backup CDU is healthy. If the 
center CDU is not healthy, the logic returns to the begin point 200 through 
10 intermediate point 212. 

It however, out of decision block 230 it is determined that the center CDU is 
operating properly, block 232 is entered. In block 232, the FMC logic causes the right 
page display to be sent to the center CDU, thereby causing the center CDU to assume 
15 the functionality of the failed right CDU. The system then returns to the begin point 
200 through intermediate position 212. 

Figure 4 is a logic flow diagram depicting the sequence of logical steps 
performed by the improved flight management system to reconfigure the databus 
20 pathways to the operating control display units. 

The system begins at 300 and proceeds to block 302 to set the rule value N=l 
At decision block 304 the system determines whether the criteria set forth in rule No. 
N of table 1 , set forth in Figures 5 A, 5B and 5C are true. If all of the criteria for a 
25 particular rule of rule N are true, the system progresses to block 306 and reconfigures 
the bus configuration to the state N of table 1 as set forth in Figures 5 A, 5B, and 5C. 

If, however, out of decision block 304, the criteria for the rule N are not true, 
in block 308 the value of N is incremented by 1. Now, in decision block 310, if the 
30 value of N is greater than or equal to 49, since there are 48 different rules stated in 
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table 1 set forth in Figures 5A, 5B and 5C, the system increments to step A at 312, 
returning to block 302 and resetting the value of N to 1. If, however, out of decision 
block 3 10 the value of N is not greater than or equal to 49, the system increments to 
decision block 304 to determine, once again, whether the rule N is true. 

5 

Figures 5 A, SB, and 5C indicate the CDU/Bus selection rules which determine 
the appropriate reconfiguration of the system to assure that one or more operating 
FMC's connect through one or more operating buses to one or more operating 
CDU's. The specific condition of the FMC's, buses and CDU's being valid or 
10 inoperable are herein referred to as "rules" in the table. Rules 1 through 47 maintain 
control by the FMC. Rule 48 is not necessary, but shows the state where there are no 
possible data paths. 

Table 1, as set forth in Figures 5 A, SB and SC is understood as follows. The 
15 three CDU columns indicate the validity of the specified CDU data on the specified bus 
where: V equals valid, I equals invalid, X equals don't care, LB equals left databus, CB 
equals center databus, and RB equals right databus. The data may be invalid either to 
a bus loss or due to failure of the specific CDU. The valid state indicates that the 
specified CDU's data is reaching the FMC over that databus. 

20 

The CDU's are required to maintain a periodic message over all three 
databuses to allow the FMC to determine allowable data paths. The column labeled 
Previous CDU_C indicates if CDU_C was last selected for the Capt CDU Display (C), 
FO CDU Display (F), or if the previous CDU_C is a Don't Care (X). If CDU_C was 

25 previously not selected and the state depends on the previous CDU_C selected, then 
Capt CDU Display shall be assumed. The right-most columns indicate the target CDU 
(LC=CDU_L, CC=CDU_C, RC=CDU_R) and bus path (LB, CB, RB defined same as 
above) to be used for each of the Capt (Captain) and FO (First Officer) CDU Displays. 
The nomenclature — indicates that the CDU display is not available on any of the 

30 CDU's. 
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The table of Figures 5 A, SB and 5C defines the CDU selections and bus 
selections for all sets of failures in the system. The Figures 5 A, SB and SC table is 
based upon three criteria: 

1 . For all sets of failure, where at least one path to one CDU exist, the 
valid CDU/BUS will be selected. 

2. For all validity states where two CDU's are available over different bus 
paths, both CDU's will operate. 

3. The selected set of CDU's should minimize the flight deck effect of 



10 failures. 



To support the analysis of the third criteria above, the table of Figure 6 
summarizes CDU transitions which can occur as the result of a single failure using the 
reconfiguration rules set forth in the Figures 5 A, SB and SC table and helps to illustrate 

15 the resultant flight deck effects. Although many reconfigurations may occur in the 

Figures 5 A, 5B and SC table, following the above three criteria, a flight deck effect will 
only occur when a transition in CDU interface to the FMC is generated. The 
transitions are listed as "12->34" where "1" indicates which CDU the Capt (Captain) 
was using, "3" which CDU is provided to the Captain as a result of the transition, "2" 

20 which CDU the FO (First Officer) was using, and "4" which CDU is provided to the 
FO as a result of the transition. Following each transition state, is a list of up to the 
first eight reconfiguration rule pairs (from the table of Figures 5 A, SB and SC) which, 
when exercised, will result in the appearance of the transition (flight deck effect) 
identified in the left column. Where more than 8 rule pairs can cause an affect, is 

25 listed. Note that the ordering of the rule pairs does not necessarily correspond to the 
order of the transition. 

In summary, an improved aircraft flight management system has been described 
in detail. The improved system is capable of detecting failure of either the left or right 
30 control display unit to automatically activate a backup control display unit to assume 
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the functionality of the failed unit. In addition, the system can detect and reconfigure 
around one or more failed databus(es). 

While a preferred embodiment of the invention has been described in detail, it 
5 should be apparent that many modifications and variations thereto are possible, all of 
which fall within the true spirit and scope of the invention. For example, whereas the 
preferred embodiment of the invention utilizes a look-up table to store the 
reconfiguration rules, other approaches, such as coded logic, are clearly within the 
scope of the present invention. 



10 
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What is claimed is: 

1 In an aircraft flight management system including at least one flight 
management computer (FMC), at least two control display units (CDU's) and at least 
5 two databuses permitting interfaces to said CDU's from said FMC, the improvement 
comprising: 

logic control means associated with said at least one FMC for: 

a) detecting failure of one CDU and/or databuses and responsive 
thereto, 

10 b) utilizing structured data routing to reroute signals over a non- 

failed databus to connect a non-failed CDU to the FMC. 

2. The improvement of claim 1 wherein the logic control means includes a 
logic look-up table setting forth the rules for the structured data routing. 

15 

3. An aircraft flight management system comprising: 
at least one flight management computer (FMC); 

left and right control display units (CDU's) permitting interfaces to said at least 
one FMC from left and right pilot positions, respectively; 
20 a third, backup CDU; 

at least two databuses linking said FMC to said left, right and backup CDU's; 

and 

logic control means associated with said at least one FMC for: 

a) detecting failure of one of said left and right CDU's and/or databuses 
25 and, responsive thereto, 

b) utilizing structured data routing to route appropriate signals over said 
databus means such that said center backup CDU is fully functional in 
place of said failed left or right CDU. 



WO 97/43704 



PCTAJS97/08117 



-15- 

4. The improvement of claim 3 wherein the logic control means includes a logic 
look-up table setting forth the rules for the structured data routing. 

5. In an aircraft flight management system including at least one flight 

5 management computer (FMC), left and right control display units (CDU's) permitting 
interfaces to said at least one FMC from left and right pilot positions over two or 
more databuses, an improved method for automatically rerouting signals between the 
FMC and a non-failed CDU over a non-failed databus, the method comprising the 
steps of: 

10 a) providing logic control means, associated with said at least one 

FMC, said logic control means performing the steps of: 

i) detecting failure of one of said left and right CDU's 
and/or databuses and, responsive thereto, 

ii) automatically rerouting signals over a non-failed databus 
15 to a non-failed CDU to the FMC. 

6. The improvement of claim 5 wherein the logic control means includes a logic 
look-up table setting forth the rules for the structured data routing. 

20 7. In an aircraft flight management system including at least one flight 

management computer (FMC), left and right control display units (CDU's) permitting 
interfaces to said at least one FMC from left and right pilot positions over multiple, 
redundant databuses respectively, the improvement comprising: 
a third backup CDU; 

25 redundant databuses linking said FMC to said left, right and backup CDU's; 

and 

logic control means associated with said at least one FMC for: 

a) detecting failure of one of said left and right CDU's or one of 
said databuses and responsive thereto, 
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b) utilizing structured data routing to route signals over a valid 
databus to cause said backup CDU to operate in place of said 
failed left or right CDU. 

5 8. The improvement of claim 7 wherein the logic control means includes a logic 
look-up table setting forth the rules for the structured data routing. 

9. An aircraft flight management system comprising: 
at least one flight management computer (FMC); 
10 left and right control display units (CDU's) permitting interfaces to said at least 

one FMC from left and right pilot positions, respectively; 
a third, backup CDU; 

multiple, redundant databuses linking said FMC to said left, right and backup 
CDU's; and 

15 logic control means associated with said at least one FMC for: 

a) detecting failure of one of said left and right CDU' s or one of said 
databuses and, responsive thereto, 

b) utilizing structured data routing to route appropriate signals over said 
databus means such that said center backup CDU is fully functional in 

20 place of said failed left or right CDU. 

10. The improvement of claim 9 wherein the logic control means includes a logic 
look-up table setting forth the rules for the structured data routing. 

25 11. In an aircraft flight management system including at least one flight 

management computer (FMC), left and right control display units (CDU's) permitting 
interfaces over multiple, redundant databuses to said at least one FMC from left and 
right pilot positions, respectively, and a third, backup CDU, an improved method for 
permitting said backup CDU t automatically function in place of a failed left or right 

30 CDU or databus, the method comprising the steps of: 
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a) linking said FMC to said left, right and backup CDU's via the 
multiple redundant databuses; 

b) providing logic control means, associated with at least one 
FMC, said logic control means performing the steps of: 

i) detecting failure of one of said left and right CDlTs or 
one of said databuses and, responsive thereto, 

ii) utilizing structured data routing to automatically route 
signals over said databus to said backup CDU such that 
said backup CDU is fully functional in place of said 
failed left or right CDU. 



12. The improvement of claim 1 1 wherein the logic control means includes a logic 
look-up table setting forth the rules for the structured data routing. 
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Table 1 CDU/Bus Selection Matrix 
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Table 1 continued CDU/Bus Selection Matrix 
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Table 1 continued COU/Bus SelecUon Matrix 
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